ticket #74 attempt 1

devplacepy/database/notifications.py

@@ -18,6 +18,7 @@ NOTIFICATION_TYPES = [
     {"key": "reminder", "label": "Reminders", "description": "A reminder or scheduled task you asked Devii to run fires"},
     {"key": "harvest_stolen", "label": "Farm raids", "description": "Someone steals a ready build from your Code Farm"},
     {"key": "award", "label": "Awards", "description": "Someone gives you an award on your profile"},
+    {"key": "admin_alert", "label": "Admin alerts", "description": "System alerts requiring admin attention"},
 ]
 
 

devplacepy/routers/devii.py

@@ -23,6 +23,7 @@ from devplacepy.utils import (
     require_user,
 )
 from devplacepy.services.audit import record as audit
+from devplacepy.services.devii.quota import notify_admins_quota_blocked
 
 logger = logging.getLogger("devii.router")
 
@@ -279,6 +280,7 @@ async def devii_ws(websocket: WebSocket):
                         summary=f"AI request by {username or owner_id} blocked - 24h quota reached",
                         metadata={"limit_usd": limit, "owner_kind": owner_kind},
                     )
+                    notify_admins_quota_blocked(owner_kind, owner_id, username)
                     await websocket.send_json(
                         {
                             "type": "error",

devplacepy/services/devii/quota.py

@@ -0,0 +1,26 @@
+# retoor <retoor@molodetz.nl>
+
+import logging
+
+from devplacepy.database import get_table
+from devplacepy.utils.notifications import create_notification
+
+logger = logging.getLogger("devii.quota")
+
+ADMIN_ALERT_TYPE = "admin_alert"
+
+
+def notify_admins_quota_blocked(owner_kind: str, owner_id: str, username: str) -> None:
+    if owner_kind != "user":
+        return
+    admins = get_table("users").find(role="Admin")
+    for admin in admins:
+        if admin["uid"] == owner_id:
+            continue
+        create_notification(
+            admin["uid"],
+            ADMIN_ALERT_TYPE,
+            f"User {username} blocked - 24h AI quota reached",
+            owner_id,
+            "/admin/users",
+        )

devplacepy/services/telegram/bridge.py

@@ -10,6 +10,7 @@ from typing import Any
 
 from devplacepy.database import get_table
 from devplacepy.services.audit import record as audit
+from devplacepy.services.devii.quota import notify_admins_quota_blocked
 from devplacepy.services.manager import service_manager
 from devplacepy.utils import is_admin, is_primary_admin
 
@@ -400,6 +401,7 @@ class TelegramBridge:
                 summary=f"Telegram AI request by {user.get('username', owner_id)} blocked - 24h quota reached",
                 metadata={"limit_usd": limit},
             )
+            notify_admins_quota_blocked("user", owner_id, user.get("username", ""))
             await self._service.send(
                 chat_id, "Your daily AI quota is reached (100%). Please try again later."
             )

devplacepy/static/js/CommentManager.js

@@ -8,11 +8,6 @@ export class CommentManager {
         this.initCommentReply();
         this.initCommentEdit();
         this.initCommentDelete();
-        document.addEventListener("paste", (event) => {
-            const textarea = event.target.closest("form textarea[name='body'], form textarea[name='content']");
-            if (!textarea) return;
-            this._onPaste(event, textarea);
-        });
     }
 
     initCommentDelete() {
@@ -213,41 +208,4 @@ export class CommentManager {
             if (btn) btn.disabled = true;
         });
     }
-
-    _onPaste(event, textarea) {
-        const items = event.clipboardData?.items;
-        if (!items) return;
-        for (const item of items) {
-            if (item.kind === "file" && item.type.startsWith("image/")) {
-                event.preventDefault();
-                const file = item.getAsFile();
-                const namedFile = new File([file], file.name || "clipboard.png", { type: file.type });
-                this._uploadImage(namedFile, textarea);
-                break;
-            }
-        }
-    }
-
-    async _uploadImage(file, textarea) {
-        const formData = new FormData();
-        formData.append("file", file, file.name);
-        try {
-            const response = await fetch("/uploads/upload", {
-                method: "POST",
-                headers: {
-                    "Accept": "application/json",
-                    "X-Requested-With": "fetch",
-                },
-                body: formData,
-            });
-            if (!response.ok) {
-                const data = await response.json().catch(() => ({}));
-                throw new Error(data.error || `Upload failed (${response.status})`);
-            }
-            const result = await response.json();
-            window.TextInput.insertAtCursor(textarea, `![](${result.url})`);
-        } catch (err) {
-            Http.notifyError(err.message);
-        }
-    }
 }

devplacepy/static/js/IssueReporter.js

@@ -12,48 +12,6 @@ export class IssueReporter {
             event.preventDefault();
             this.submit(form);
         });
-        document.addEventListener("paste", (event) => {
-            const textarea = event.target.closest("form[data-issue-create] [name='description']");
-            if (!textarea) return;
-            this._onPaste(event, textarea);
-        });
-    }
-
-    _onPaste(event, textarea) {
-        const items = event.clipboardData?.items;
-        if (!items) return;
-        for (const item of items) {
-            if (item.kind === "file" && item.type.startsWith("image/")) {
-                event.preventDefault();
-                const file = item.getAsFile();
-                const namedFile = new File([file], file.name || "clipboard.png", { type: file.type });
-                this._uploadImage(namedFile, textarea);
-                break;
-            }
-        }
-    }
-
-    async _uploadImage(file, textarea) {
-        const formData = new FormData();
-        formData.append("file", file, file.name);
-        try {
-            const response = await fetch("/uploads/upload", {
-                method: "POST",
-                headers: {
-                    "Accept": "application/json",
-                    "X-Requested-With": "fetch",
-                },
-                body: formData,
-            });
-            if (!response.ok) {
-                const data = await response.json().catch(() => ({}));
-                throw new Error(data.error || `Upload failed (${response.status})`);
-            }
-            const result = await response.json();
-            window.TextInput.insertAtCursor(textarea, `![](${result.url})`);
-        } catch (err) {
-            Http.notifyError(err.message);
-        }
     }
 
     async submit(form) {

tests/api/uploads/upload.py

@@ -240,17 +240,3 @@ def test_delete_own_allowed_other_user_forbidden(app_server):
     bob = _session_uploads()
     assert bob.delete(f"{BASE_URL}/uploads/delete/{uid}").status_code == 403
     assert alice.delete(f"{BASE_URL}/uploads/delete/{uid}").status_code == 200
-
-
-def test_paste_image_upload_returns_url(app_server):
-    s = _session_uploads()
-    r = s.post(
-        f"{BASE_URL}/uploads/upload",
-        files={"file": ("clipboard.png", _png_bytes_uploads(), "image/png")},
-    )
-    assert r.status_code == 201, r.text
-    data = r.json()
-    assert "url" in data
-    assert data["url"].startswith("/static/uploads/attachments/")
-    assert data["uid"]
-    assert data["is_image"] is True

venv/bin/python

@@ -1 +0,0 @@
-python3

venv/bin/python3

@@ -1 +0,0 @@
-/usr/bin/python3

venv/bin/python3.11

@@ -1 +0,0 @@
-python3

venv/lib64

@@ -1 +0,0 @@
-lib

venv/pyvenv.cfg

@@ -1,5 +0,0 @@
-home = /usr/bin
-include-system-site-packages = false
-version = 3.11.2
-executable = /usr/bin/python3.11
-command = /usr/bin/python3 -m venv /workspace/repo/venv